Israeli spyware company (also known as Saito Tech) that developed DevilsTongue surveillance software. Placed on U.S. Entity List in 2021. In 2025, acquired by U.S. firm Integrity Partners for $30M in apparent sanctions evasion.
In April 2025, U.S. investment firm Integrity Partners acquired sanctioned Israeli spyware maker Candiru for $30 million. The deal transferred all employees to a new entity not subject to U.S. sanctions, demonstrating a critical enforcement gap: an American company investing in an Entity List company undermines U.S. government spyware constraints.
In July 2024, European Parliament member Daniel Freund reported a spyware attack attempt assessed as likely emanating from Candiru. The attack masqueraded as a legitimate email link. Freund, a vocal critic of Hungarian PM Viktor Orbán, believes Hungary's authoritarian administration was responsible. Active Candiru infrastructure was identified in Hungary and Saudi Arabia through late 2024.
Amnesty International's May 2024 report uncovered links between Indonesian government bodies and Candiru going back to 2017. Candiru-linked domains were found imitating legitimate Indonesian news sites including state news agency ANTARA. Singapore summoned an Israeli official in 2020 after discovering Israeli firms sold digital intelligence to Indonesia.
In November 2021, the U.S. Department of Commerce added Candiru alongside NSO Group to the Entity List, accusing the company of developing and supplying spyware to foreign governments that maliciously targeted government officials, journalists, businesspeople, activists, academics, and embassy workers.